IDA SDK
|
Routines to manipulate function stack frames, stack variables, register variables and local labels.
The frame is represented as a structure:
+------------------------------------------------+ | function arguments (func_t::argsize) | +------------------------------------------------+ | return address (isn't stored in func_t) | +------------------------------------------------+ | saved registers (SI, DI, etc - func_t::frregs) | +------------------------------------------------+ <- typical BP | | | | | | func_t::fpd | | | | | <- real BP | local variables (func_t::frsize) | | | | | +------------------------------------------------+ <- SP
To access the structure of a function frame, use:
Classes | |
struct | regvar_t |
A register variable allows the user to rename a general processor register to a meaningful name. More... | |
struct | llabel_t |
Local label. More... | |
struct | xreflist_entry_t |
An xref to an argument or variable located in a function's stack frame. More... | |
Functions | |
idaman bool ida_export | add_frame (func_t *pfn, sval_t frsize, ushort frregs, asize_t argsize) |
Add function frame. More... | |
idaman bool ida_export | del_frame (func_t *pfn) |
Delete a function frame. More... | |
idaman bool ida_export | set_frame_size (func_t *pfn, asize_t frsize, ushort frregs, asize_t argsize) |
Set size of function frame. More... | |
idaman asize_t ida_export | get_frame_size (const func_t *pfn) |
Get full size of a function frame. More... | |
idaman int ida_export | get_frame_retsize (const func_t *pfn) |
Get size of function return address. More... | |
idaman void ida_export | get_frame_part (range_t *range, const func_t *pfn, frame_part_t part) |
Get offsets of the frame part in the frame. More... | |
ea_t | frame_off_args (const func_t *pfn) |
Get starting address of arguments section. | |
ea_t | frame_off_retaddr (const func_t *pfn) |
Get starting address of return address section. | |
ea_t | frame_off_savregs (const func_t *pfn) |
Get starting address of saved registers section. | |
ea_t | frame_off_lvars (const func_t *pfn) |
Get start address of local variables section. | |
bool | is_funcarg_off (const func_t *pfn, uval_t frameoff) |
Does the given offset lie within the arguments section? | |
sval_t | lvar_off (const func_t *pfn, uval_t frameoff) |
Does the given offset lie within the local variables section? | |
idaman struc_t *ida_export | get_frame (const func_t *pfn) |
Get pointer to function frame. More... | |
struc_t * | get_frame (ea_t ea) |
Get pointer to function frame. More... | |
idaman bool ida_export | update_fpd (func_t *pfn, asize_t fpd) |
Update frame pointer delta. More... | |
idaman bool ida_export | set_purged (ea_t ea, int nbytes, bool override_old_value) |
Set the number of purged bytes for a function or data item (funcptr). More... | |
idaman ea_t ida_export | get_func_by_frame (tid_t frame_id) |
Get function by its frame id. More... | |
idaman member_t *ida_export | get_stkvar (sval_t *actval, const insn_t &insn, const op_t &x, sval_t v) |
Get pointer to stack variable. More... | |
idaman bool ida_export | add_stkvar (const insn_t &insn, const op_t &x, sval_t v, int flags) |
Automatically add stack variable if doesn't exist. More... | |
idaman bool ida_export | define_stkvar (func_t *pfn, const char *name, sval_t off, flags_t flags, const opinfo_t *ti, asize_t nbytes) |
Define/redefine a stack variable. More... | |
idaman ssize_t ida_export | build_stkvar_name (qstring *buf, const func_t *pfn, sval_t v) |
Build automatic stack variable name. More... | |
idaman ea_t ida_export | calc_stkvar_struc_offset (func_t *pfn, const insn_t &insn, int n) |
Calculate offset of stack variable in the frame structure. More... | |
idaman int ida_export | delete_unreferenced_stkvars (func_t *pfn) |
Find and delete unreferenced stack variable definitions. More... | |
idaman int ida_export | delete_wrong_stkvar_ops (func_t *pfn) |
Find and undefine references to dead stack variables. More... | |
idaman int ida_export | add_regvar (func_t *pfn, ea_t ea1, ea_t ea2, const char *canon, const char *user, const char *cmt) |
Define a register variable. More... | |
idaman regvar_t *ida_export | find_regvar (func_t *pfn, ea_t ea1, ea_t ea2, const char *canon, const char *user) |
Find a register variable definition (powerful version). More... | |
regvar_t * | find_regvar (func_t *pfn, ea_t ea, const char *canon) |
Find a register variable definition. More... | |
idaman int ida_export | rename_regvar (func_t *pfn, regvar_t *v, const char *user) |
Rename a register variable. More... | |
idaman int ida_export | set_regvar_cmt (func_t *pfn, regvar_t *v, const char *cmt) |
Set comment for a register variable. More... | |
idaman int ida_export | del_regvar (func_t *pfn, ea_t ea1, ea_t ea2, const char *canon) |
Delete a register variable definition. More... | |
idaman bool ida_export | add_auto_stkpnt (func_t *pfn, ea_t ea, sval_t delta) |
Add automatic SP register change point. More... | |
idaman bool ida_export | add_user_stkpnt (ea_t ea, sval_t delta) |
Add user-defined SP register change point. More... | |
idaman bool ida_export | del_stkpnt (func_t *pfn, ea_t ea) |
Delete SP register change point. More... | |
idaman sval_t ida_export | get_spd (func_t *pfn, ea_t ea) |
Get difference between the initial and current values of ESP. More... | |
idaman sval_t ida_export | get_effective_spd (func_t *pfn, ea_t ea) |
Get effective difference between the initial and current values of ESP. More... | |
idaman sval_t ida_export | get_sp_delta (func_t *pfn, ea_t ea) |
Get modification of SP made at the specified location. More... | |
idaman ea_t ida_export | get_min_spd_ea (func_t *pfn) |
Get the address with the minimal spd (stack pointer delta). More... | |
idaman bool ida_export | recalc_spd (ea_t cur_ea) |
Recalculate SP delta for an instruction that stops execution. More... | |
idaman void ida_export | build_stkvar_xrefs (xreflist_t *out, func_t *pfn, const member_t *mptr) |
Fill 'out' with a list of all the xrefs made from function 'pfn', to the argument or variable 'mptr' in 'pfn's stack frame. More... | |
Local Labels | |
These are LOW LEVEL FUNCTIONS. When possible, they should not be used. Use high level functions from <name.hpp> | |
bool | set_llabel (func_t *pfn, ea_t ea, const char *name) |
Define/rename/delete a local label. More... | |
ea_t | get_llabel_ea (func_t *pfn, const char *name) |
Get address of a local label. More... | |
const char * | get_llabel (func_t *pfn, ea_t ea) |
Get local label at the specified address. More... | |
Macros | |
#define | STKVAR_VALID_SIZE 0x0001 |
x.dtyp contains correct variable type More... | |
#define | REGVAR_ERROR_OK 0 |
all ok | |
#define | REGVAR_ERROR_ARG (-1) |
function arguments are bad | |
#define | REGVAR_ERROR_RANGE (-2) |
the definition range is bad | |
#define | REGVAR_ERROR_NAME (-3) |
the provided name(s) can't be accepted | |
Typedefs | |
typedef qvector< xreflist_entry_t > | xreflist_t |
vector of xrefs to variables in a function's stack frame | |
Enumerations | |
enum | frame_part_t { FPC_ARGS, FPC_RETADDR, FPC_SAVREGS, FPC_LVARS } |
Parts of a frame. | |
Add function frame.
pfn | pointer to function structure |
frsize | size of function local variables |
frregs | size of saved registers |
argsize | size of function arguments range which will be purged upon return. this parameter is used for __stdcall and __pascal calling conventions. for other calling conventions please pass 0. |
1 | ok |
0 | failed (no function, frame already exists) |
idaman bool ida_export del_frame | ( | func_t * | pfn | ) |
Delete a function frame.
pfn | pointer to function structure |
idaman bool ida_export set_frame_size | ( | func_t * | pfn, |
asize_t | frsize, | ||
ushort | frregs, | ||
asize_t | argsize | ||
) |
Set size of function frame.
pfn | pointer to function structure |
frsize | size of function local variables |
frregs | size of saved registers |
argsize | size of function arguments |
idaman asize_t ida_export get_frame_size | ( | const func_t * | pfn | ) |
Get full size of a function frame.
This function takes into account size of local variables + size of saved registers + size of return address + size of function arguments.
pfn | pointer to function structure, may be NULL |
idaman int ida_export get_frame_retsize | ( | const func_t * | pfn | ) |
Get size of function return address.
pfn | pointer to function structure, can't be NULL |
idaman void ida_export get_frame_part | ( | range_t * | range, |
const func_t * | pfn, | ||
frame_part_t | part | ||
) |
Get offsets of the frame part in the frame.
range | pointer to the output buffer with the frame part start/end(exclusive) offsets, can't be NULL |
pfn | pointer to function structure, can't be NULL |
part | frame part |
idaman struc_t* ida_export get_frame | ( | const func_t * | pfn | ) |
Get pointer to function frame.
pfn | pointer to function structure |
Get pointer to function frame.
ea | any address in the function |
idaman bool ida_export update_fpd | ( | func_t * | pfn, |
asize_t | fpd | ||
) |
Update frame pointer delta.
pfn | pointer to function structure |
fpd | new fpd value. can not be bigger than the local variable range size. |
idaman bool ida_export set_purged | ( | ea_t | ea, |
int | nbytes, | ||
bool | override_old_value | ||
) |
Set the number of purged bytes for a function or data item (funcptr).
This function will update the database and plan to reanalyze items referencing the specified address. It works only for processors with PR_PURGING bit in 16 and 32 bit modes.
ea | address of the function of item |
nbytes | number of purged bytes |
override_old_value | may overwrite old information about purged bytes |
idaman ea_t ida_export get_func_by_frame | ( | tid_t | frame_id | ) |
Get function by its frame id.
frame_id | id of the function frame |
idaman member_t* ida_export get_stkvar | ( | sval_t * | actval, |
const insn_t & | insn, | ||
const op_t & | x, | ||
sval_t | v | ||
) |
Get pointer to stack variable.
actval | actual value used to fetch stack variable this pointer may point to 'v' |
insn | the instruction |
x | reference to instruction operand |
v | immediate value in the operand (usually x.addr) |
idaman bool ida_export add_stkvar | ( | const insn_t & | insn, |
const op_t & | x, | ||
sval_t | v, | ||
int | flags | ||
) |
Automatically add stack variable if doesn't exist.
Processor modules should use insn_t::create_stkvar().
insn | the instruction |
x | reference to instruction operand |
v | immediate value in the operand (usually x.addr) |
flags | Add stkvar flags |
idaman bool ida_export define_stkvar | ( | func_t * | pfn, |
const char * | name, | ||
sval_t | off, | ||
flags_t | flags, | ||
const opinfo_t * | ti, | ||
asize_t | nbytes | ||
) |
Define/redefine a stack variable.
pfn | pointer to function |
name | variable name, NULL means autogenerate a name |
off | offset of the stack variable in the frame. negative values denote local variables, positive - function arguments. |
flags | variable type flags (byte_flag() for a byte variable, for example) |
ti | additional type information (like offsets, structs, etc) |
nbytes | number of bytes occupied by the variable |
Build automatic stack variable name.
buf | pointer to buffer |
pfn | pointer to function (can't be NULL!) |
v | value of variable offset |
idaman ea_t ida_export calc_stkvar_struc_offset | ( | func_t * | pfn, |
const insn_t & | insn, | ||
int | n | ||
) |
idaman int ida_export delete_unreferenced_stkvars | ( | func_t * | pfn | ) |
Find and delete unreferenced stack variable definitions.
pfn | pointer to the function |
idaman int ida_export delete_wrong_stkvar_ops | ( | func_t * | pfn | ) |
Find and undefine references to dead stack variables.
(i.e. operands displayed in red) These operands will be untyped and most likely displayed in hex.
pfn | pointer to the function |
Define/rename/delete a local label.
THIS IS A LOW LEVEL FUNCTION - use set_name() instead of it!
pfn | function in which the definition will be created |
ea | linear address of the label |
name | name of the label. If NULL or empty string, name will be removed |
Get address of a local label.
THIS IS A LOW LEVEL FUNCTION - use get_name_ea() instead of it!
pfn | function in question |
name | name of the label |
Get local label at the specified address.
THIS IS A LOW LEVEL FUNCTION - use get_name() instead of it!
pfn | function in question |
ea | linear address of the label |
idaman bool ida_export add_auto_stkpnt | ( | func_t * | pfn, |
ea_t | ea, | ||
sval_t | delta | ||
) |
Add automatic SP register change point.
pfn | pointer to function. may be NULL. |
ea | linear address where SP changes. usually this is the end of the instruction which modifies the stack pointer ( insn_t::ea+ insn_t::size) |
delta | difference between old and new values of SP |
idaman bool ida_export add_user_stkpnt | ( | ea_t | ea, |
sval_t | delta | ||
) |
Add user-defined SP register change point.
ea | linear address where SP changes |
delta | difference between old and new values of SP |
idaman bool ida_export del_stkpnt | ( | func_t * | pfn, |
ea_t | ea | ||
) |
Delete SP register change point.
pfn | pointer to function. may be NULL. |
ea | linear address |
idaman sval_t ida_export get_spd | ( | func_t * | pfn, |
ea_t | ea | ||
) |
Get difference between the initial and current values of ESP.
pfn | pointer to function. may be NULL. |
ea | linear address of an instruction |
idaman sval_t ida_export get_effective_spd | ( | func_t * | pfn, |
ea_t | ea | ||
) |
Get effective difference between the initial and current values of ESP.
This function returns the sp-diff used by the instruction. The difference between get_spd() and get_effective_spd() is present only for instructions like "pop [esp+N]": they modify sp and use the modified value.
pfn | pointer to function. may be NULL. |
ea | linear address |
idaman sval_t ida_export get_sp_delta | ( | func_t * | pfn, |
ea_t | ea | ||
) |
Get modification of SP made at the specified location.
pfn | pointer to function. may be NULL. |
ea | linear address |
idaman ea_t ida_export get_min_spd_ea | ( | func_t * | pfn | ) |
Get the address with the minimal spd (stack pointer delta).
If there are no SP change points, then return BADADDR.
idaman bool ida_export recalc_spd | ( | ea_t | cur_ea | ) |
Recalculate SP delta for an instruction that stops execution.
The next instruction is not reached from the current instruction. We need to recalculate SP for the next instruction.
This function will create a new automatic SP register change point if necessary. It should be called from the emulator (emu.cpp) when auto_state == AU_USED if the current instruction doesn't pass the execution flow to the next instruction.
cur_ea | linear address of the current instruction |
1 | new stkpnt is added |
0 | nothing is changed |
idaman void ida_export build_stkvar_xrefs | ( | xreflist_t * | out, |
func_t * | pfn, | ||
const member_t * | mptr | ||
) |
Fill 'out' with a list of all the xrefs made from function 'pfn', to the argument or variable 'mptr' in 'pfn's stack frame.
out | the list of xrefs to fill. |
pfn | the function to scan. |
mptr | the argument/variable in pfn's stack frame. |